Multi-thread software and hardware fault analysis method and device applied to lock step core

Abstract

The invention provides a multi-thread software and hardware fault analysis method and device applied to a lock step core, and relates to the technical field of software and hardware fault monitoring of an ECU (Electronic Control Unit), and the method comprises the following steps: respectively detecting internal hardware of a multi-core processor and a software process of each thread in a current period; if the internal hardware has the fault in the current period, storing and backing up the first software and hardware information at the first current moment according to a preset fault type, and resetting the internal hardware; if the software process has a fault in the current period, storing and backing up second software and hardware information at a second current moment according to a preset fault type, and resetting the software process; analyzing software and hardware faults of the lock step core according to the first software and hardware information and the second software and hardware information; hardware fault detection and software fault detection are unified in the same time sequence, so that the technical problem that data interference and data pollution are easily caused when fault analysis is carried out through backup data subsequently is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of software and hardware fault monitoring of an ECU, and in particular to a multi-threaded software and hardware fault analysis method and device applied to a lock-step core. Background Art

[0002] As the number of ECUs and lines of code on self-driving cars increases day by day, the complexity of the entire automotive system is also increasing. At the same time, the complexity of the self-driving system and the diversity of software algorithms have led to an increasing number of parts that require design of expected functional safety. Automotive functional safety has become an issue that cannot be ignored.

[0003] The current international standards clearly require the use of watchdogs for software time monitoring and program flow monitoring to improve the functional safety level of the entire hardware and software system. At present, multi-core processors have added the Lock-Step function, which has become a hardware redundant safety design in autonomous driving and one of the measures to achieve high diagnostic coverage.

[0004] However, in the current system diagnosis and processing, when a system hardware or software failure occurs, the overall hardware and software system is unable to perform unified backup processing and unified reset operations, resulting in misaligned fault data between multiple cores and multiple threads, causing data interference and data pollution for subsequent fault analysis and fault recovery. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide a multi-threaded hardware and software fault analysis method and device applied to a lock-step core, by unifying hardware fault detection and software fault detection under the same timing, and backing up and aligning the hardware and software data at the same time when any fault occurs, so as to alleviate the technical problem of data interference and data pollution caused by subsequent fault analysis through such backup data.

[0006] In a first aspect, an embodiment provides a multi-threaded software and hardware fault analysis method applied to a lock-step core, wherein each ECU includes a multi-core processor, each multi-core processor includes at least one lock-step core, and each lock-step core is configured with multiple threads. The method is applied to the lock-step core, including:

[0007] In the current cycle, the internal hardware of the multi-core processor and the software process of each thread are detected respectively; wherein the detection of the internal hardware and the software process occurs in the same cycle;

[0008] If the internal hardware has a processing logic fault in the current cycle, the first software and hardware information at the first current moment is stored and backed up according to the preset fault type, and the internal hardware is reset; wherein the first software and hardware information is used to represent the hardware data and software data corresponding to the preset fault type when a hardware fault occurs at the first current moment;

[0009] If a software process of at least one thread in the lock-step core has a fault in the current cycle, the second software and hardware information at the second current moment is stored and backed up according to the preset fault type, and the software process is reset; wherein the second software and hardware information is used to represent the hardware data and software data corresponding to the preset fault type when a software fault occurs at the second current moment;

[0010] The software and hardware failures of the lock-step core are analyzed according to the first software and hardware information and the second software and hardware information.

[0011] In an optional implementation, the step of detecting the internal hardware of the multi-core processor and the software process of each thread in the current cycle respectively includes:

[0012] The fault detection operation on the internal hardware of the multi-core processor and the fault detection operation on the software process of each thread are associated and executed in the same current cycle, so that the hardware fault detection result and the software fault detection result of the lock-step core are in the same time sequence.

[0013] In an optional implementation manner, if the internal hardware has a processing logic fault in the current cycle, the step of storing and backing up the first software and hardware information at the first current moment according to a preset fault type and resetting the internal hardware includes:

[0014] Under the function of the lock-step core, detecting whether there is a processing logic fault in the internal hardware of the multi-core processor in the current cycle;

[0015] If a hardware failure occurs, the first hardware and software information at the first current moment is stored and backed up according to the preset fault type, the internal hardware of the multi-core processor is reset, and the hardware and software system corresponding to the ECU is restarted; wherein the first hardware and software information includes hardware data and software data that meet the requirements of the preset fault type at the first current moment.

[0016] In an optional implementation, if a software process of at least one thread in the lock-step core fails in a current cycle, the step of storing and backing up the second software and hardware information at a second current moment according to a preset fault type and resetting the software process includes:

[0017] Based on the comparison result of the actual execution times and the preset execution times of each thread of the lock-step core in the preset cycle, judging whether the software process of each thread has a fault in the current cycle; wherein the functional safety level of each thread corresponds to the preset execution times in the corresponding preset cycle;

[0018] If a fault exists, the second software and hardware information at the second current moment is stored and backed up according to the preset fault type, and the software process is reset; wherein the second software and hardware information includes hardware data and software data that meet the preset fault type requirements at the second current moment.

[0019] In an optional implementation manner, if there is a fault, the step of storing and backing up the second software and hardware information at the second current moment according to a preset fault type and resetting the software process further includes:

[0020] Refresh the hardware trigger value corresponding to each thread according to the fault detection result of the software process of each thread in the current cycle;

[0021] If the software process in the current thread has a fault in the current cycle, determining whether the hardware trigger value is greater than zero;

[0022] If the hardware trigger value is greater than zero, the watchdog is fed during the interrupt cycle of the hardware watchdog, and the hardware trigger value is reduced by one, and then the step of determining whether the hardware trigger value is greater than zero is performed;

[0023] If the hardware trigger value is less than zero, the second software and hardware information at the second current moment is stored and backed up according to the preset fault type, and the software process is reset.

[0024] In an optional implementation, the step of refreshing the hardware trigger value corresponding to each thread according to the fault detection result of the software process of each thread in the current cycle includes:

[0025] If the software process of the current thread fails in the current cycle, the hardware trigger value corresponding to the current thread is refreshed to zero;

[0026] If the software process of the current thread does not have any faults in the current cycle, the hardware trigger value corresponding to the current thread is refreshed to an initial value; wherein the initial value is determined based on the fault tolerance requirement and fault recovery time requirement of each thread.

[0027] In an optional implementation manner, before the step of respectively detecting the internal hardware of the multi-core processor and the software process of each thread in the current cycle, the method further includes:

[0028] Initialize the peripherals of the hardware watchdog, and configure the interrupt cycle of the hardware watchdog and the fault detection configuration information corresponding to each functional safety level.

[0029] In a second aspect, an embodiment provides a multi-threaded software and hardware fault analysis device applied to a lock-step core, wherein each ECU includes a multi-core processor, each multi-core processor includes at least one lock-step core, and each lock-step core is configured with multiple threads. The device is applied to the lock-step core, including:

[0030] A detection module, which detects the internal hardware of the multi-core processor and the software process of each thread in a current cycle; wherein the detection of the internal hardware and the software process occurs in the same cycle;

[0031] A hardware fault backup module, if the internal hardware has a processing logic fault in the current cycle, stores and backs up the first software and hardware information at the first current moment according to a preset fault type, and resets the internal hardware; wherein the first software and hardware information is used to represent the hardware data and software data corresponding to the preset fault type when a hardware fault occurs at the first current moment;

[0032] A software fault backup module, if a software process of at least one thread in the lock-step core has a fault in a current cycle, stores and backs up second software and hardware information at a second current moment according to a preset fault type, and resets the software process; wherein the second software and hardware information is used to represent hardware data and software data corresponding to the preset fault type when a software fault occurs at the second current moment;

[0033] An analysis module analyzes the software and hardware failures of the lock-step core according to the first software and hardware information and the second software and hardware information.

[0034] In a third aspect, an embodiment provides an electronic device, including a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the processor executes the computer program, the steps of the method described in any of the aforementioned implementation methods are implemented.

[0035] In a fourth aspect, an embodiment provides a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions. When the machine-executable instructions are called and executed by a processor, the machine-executable instructions prompt the processor to implement the steps of the method described in any one of the aforementioned implementations.

[0036] A multi-threaded hardware and software fault analysis method and device applied to a lock-step core provided by an embodiment of the present invention places the hardware fault detection and software fault detection of the lock-step core in the same timing cycle. If a hardware fault occurs in the cycle, the hardware and software data of the predetermined fault type corresponding to the time when the hardware fault occurs are backed up, and then the hardware state is reset to make the hardware fault disappear; at this time, the backup data can know the time when the hardware fault occurs in the current cycle, and the specific state of the hardware data and software data of the fault type encountered at the time; on this basis, if a software fault occurs in the cycle, the hardware and software data of the predetermined fault type corresponding to the time when the software fault occurs are backed up, and then the software state is reset; here, the backup data can know the time when the software fault occurs in the current cycle, and the software data of the fault type encountered at the time and the specific state of the software data; according to the first hardware and software information and the second hardware and software information, the time when the hardware fault and the software fault occur respectively in the current timing cycle, and the hardware and software data of the predetermined type when each fault occurs, so as to achieve alignment and unification of the hardware and software data, and effectively analyze the hardware and software faults of the lock-step core.

[0037] Other features and advantages of the present disclosure will be set forth in the following description, or some features and advantages may be inferred or unambiguously determined from the description, or may be learned by implementing the above-mentioned technology of the present disclosure.

[0038] In order to make the above-mentioned objectives, features and advantages of the present disclosure more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 A flow chart of a multi-threaded software and hardware fault analysis method applied to a lock-step core provided by an embodiment of the present invention;

[0041] Figure 2 A schematic diagram of an application architecture of a multi-threaded software and hardware fault analysis method applied to a lock-step core provided by an embodiment of the present invention;

[0042] Figure 3 A flowchart of another multi-threaded software and hardware fault analysis method applied to a lockstep core provided by an embodiment of the present invention;

[0043] Figure 4 A functional module diagram of a multi-threaded software and hardware fault analysis device applied to a lock-step core provided by an embodiment of the present invention;

[0044] Figure 5 A schematic diagram of the hardware architecture of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] The current international standards clearly require the use of watchdogs for software time monitoring and program flow monitoring to improve the functional safety level of the entire hardware and software system. At present, multi-core processors have added the Lock-Step function, which has become a hardware redundant safety design in autonomous driving and one of the measures to achieve high diagnostic coverage.

[0047] However, in the current system diagnosis and processing, watchdog monitoring of multi-core and multi-threading or lock-step core fault diagnosis is used, but unified and combined processing is not achieved, resulting in misaligned fault data between multi-core and multi-threading, causing data interference and data pollution for subsequent fault analysis and fault recovery.

[0048] Based on this, an embodiment of the present invention provides a multi-threaded hardware and software fault analysis method and device applied to a lock-step core, which can unify hardware fault detection and software fault detection under the same timing, and simultaneously back up and align the hardware and software data when any fault occurs, so that the backed-up hardware and software data has dual identification of the hardware and software fault type and the time when the fault occurs, and has a more accurate analysis effect when the backed-up hardware and software data is subsequently used for fault analysis.

[0049] To facilitate understanding of this embodiment, a multi-threaded software and hardware fault analysis method for a lock-step core disclosed in an embodiment of the present invention is first introduced in detail. The method can be applied to a lock-step core; wherein, an actual vehicle includes multiple ECUs, each ECU includes a multi-core processor, each multi-core processor includes at least one lock-step core, and each lock-step core is configured with multiple threads; the method provided in the embodiment of the present invention can be used to monitor and analyze software and hardware faults in the ECU, especially software and hardware faults of the lock-step core in the ECU and its configured threads.

[0050] Figure 1A flow chart of a multi-threaded software and hardware fault analysis method applied to a lock-step core provided by an embodiment of the present invention.

[0051] like Figure 1 As shown, the method comprises the following steps:

[0052] Step S102: In the current cycle, internal hardware of the multi-core processor and the software process of each thread are detected respectively.

[0053] Among them, the detection of internal hardware and software processes occurs in the same cycle; the cycle can be set according to actual conditions, such as a value of 20 milliseconds; the internal hardware detection and the software process detection of each thread are placed in the same cycle, so that the software fault detection result and the hardware fault detection result have time correlation, that is, the software fault detection result and the hardware fault detection result at this time can be synchronously compared.

[0054] Step S104: if the internal hardware has a processing logic fault in the current cycle, the first software and hardware information at the first current moment is stored and backed up according to a preset fault type, and the internal hardware is reset.

[0055] Among them, the first hardware and software information is used to characterize the hardware data and software data corresponding to the preset fault type when a hardware fault occurs at the first current moment; the first hardware and software information can know the time when the hardware fault occurs and the values ​​of the hardware data and software data corresponding to the preset fault type in the case of the hardware fault.

[0056] It should be noted that if there is a logical processing failure in the internal hardware of the multi-core processor, the internal hardware of the multi-core processor is reset after the storage backup. After the reset operation, the hardware failure is eliminated by default, that is, if there is no hardware failure, continue to execute subsequent steps.

[0057] Step S106: if a software process of at least one thread in the lock-step core fails in the current cycle, the second software and hardware information at the second current moment is stored and backed up according to a preset failure type, and the software process is reset.

[0058] Among them, the second hardware and software information is used to characterize the hardware data and software data corresponding to the preset fault type when a software fault occurs at the second current moment; the second hardware and software information can know the time when the software fault occurs and the values ​​of the hardware data and software data corresponding to the preset fault type in the case of the software fault.

[0059] It should be noted that if there is a software process failure in at least one thread of the lock-step core of the multi-core processor, the software process of the multi-core processor is reset after the storage backup. After the reset operation, it is assumed that the software failure is eliminated, that is, if there is no software failure, the subsequent steps are continued.

[0060] Step S108: analyzing the software and hardware failures of the lock-step core according to the first software and hardware information and the second software and hardware information.

[0061] It should be noted that the first software and hardware information and the second software and hardware information both have the time of occurrence of the corresponding fault, as well as the presentation of software data and hardware data of the specific fault type corresponding to the time of occurrence of each fault. Based on such first software and hardware information and the second software and hardware information, a more accurate analysis of the fault can be performed, and such data will not interfere with each other and cause data pollution.

[0062] In a preferred embodiment of actual application, the hardware fault detection and software fault detection of the lock-step core are placed in the same timing cycle. If a hardware fault occurs in the cycle, the hardware and software data of the predetermined fault type corresponding to the time when the hardware fault occurs are backed up, and then the hardware state is reset to make the hardware fault disappear; at this time, the backup data can know the time when the hardware fault occurs in this cycle, and the specific state of the hardware data and software data of the fault type encountered at this moment; on this basis, if a software fault occurs in the cycle, the hardware and software data of the predetermined fault type corresponding to the time when the software fault occurs are backed up, and then the software state is reset; here, the backup data can know the time when the software fault occurs in this cycle, and the software data of the fault type encountered at this moment and the specific state of the software data; according to the first hardware and software information and the second hardware and software information, the time when the hardware fault and the software fault occur respectively in the current timing cycle, and the predetermined type of hardware and software data when each fault occurs, can be known, thereby realizing the alignment and unification of the hardware and software data, and effectively analyzing the hardware and software faults of the lock-step core.

[0063] As an optional embodiment, the architecture of the multi-threaded software and hardware fault analysis method applied to the lock-step core can be as follows: Figure 2As shown in the figure, each ECU includes a multi-core processor, which includes multiple cores, and each core is configured with multiple threads; for example, taking a certain n-core automotive processor as an example, Core0, Core1, Core2, and Core3 are lock-step cores that can activate the Lock-Step function, and Coren does not support the Lock-Step function; the Lock-Step function fault detection is enabled for Core0 to Core3 to ensure the safety of the hardware system. According to the system software requirements, each core can be configured with multiple threads, and different threads have different functional safety levels.

[0064] The hardware-software fusion monitoring module includes the Lock-Step function fault detection module and the watchdog cycle monitoring module (WdgM) based on the NeuSAR platform. The WdgM module performs cycle monitoring on all threads of all cores to ensure that all software threads of the processor are within the watchdog monitoring range to ensure the reliability of software operation.

[0065] In actual applications, when the ECU executes a program, due to unknown faults, exceeding expected resources and time consumption, etc., the program execution of the key thread may time out, or the logical state switching of the key thread may be wrong, or the program may run away. Once this phenomenon occurs, the software fault must be handled. Due to the multi-core and multi-threaded architecture of the automotive autonomous driving system, different ASIL levels are divided according to the functional safety level, including four levels, namely A, B, C, D and QM, where A is the lowest safety level and D is the highest safety level; the higher the ASIL level, the greater the risk of harm, and QM is in compliance with normal quality management; different execution times will be set for threads of different functional safety levels within the preset cycle, and the watchdog monitoring logic (software watchdog) will give different monitoring measures to threads of different safety levels based on this.

[0066] As an optional embodiment, for threads with the highest functional safety level, when the thread is blocked or runs away, the watchdog monitoring should immediately take fault action to ensure the safety of the software and hardware systems; for threads at QM level or lower levels, the watchdog monitoring needs to reserve fault self-recovery time and have a fault-tolerant mechanism to ensure the robustness and stability of the entire software system.

[0067] For the current multi-core processor architecture, the Lock-Step function is available, which has faster error detection and higher error coverage, covering various error types such as hardware, transient and continuous, making up for the defect that the watchdog can only monitor the software program logic; at the same time, this function does not occupy additional processor software resources, does not require additional software overhead, has no effect on storage space, and occupies almost no Flash and RAM space. Due to the reduction in the number of hardware components and connections, compared with the use of two independent MCUs, the reliability of the hardware is improved, the fault diagnosis capability is improved, the fault is detected from the source and when it first occurs, and the latent fault will not be missed. At the same time, the reliability of the software is improved, and the communication and data synchronization of the dual CPUs are not required, the data comparison and decision logic are reduced, and the complexity of software verification is reduced.

[0068] Before step S102, the method provided by the embodiment of the present invention further includes initialization and specific information configuration, including:

[0069] Step 1.1), initialize the peripherals of the hardware watchdog, configure the interrupt cycle of the hardware watchdog and the fault detection configuration information corresponding to each functional safety level.

[0070] First, initialize the hardware watchdog peripherals, mainly configuring the interrupt cycle of the window watchdog, i.e., the feeding cycle, and the fault detection configuration related to functional safety. The interrupt cycle can be 16 milliseconds, 64 milliseconds, etc., and can be set accordingly according to the actual situation. The fault detection configuration information can be understood as the actual hardware fault related to engineering safety that will occur. That is, based on the fault detection configuration information, it can be known that under different functional safety levels, what kind of specific hardware situation belongs to the hardware fault under the functional safety level.

[0071] Secondly, the window development specification management WdgM module in NeuSAR software is initialized, the WdgM module is enabled, and the cycle monitoring function of all threads is turned on. The monitoring cycle of each thread can be set according to actual conditions, such as 20 milliseconds.

[0072] In some embodiments, step S102 of detecting the internal hardware of the multi-core processor and the software process of each thread in the current cycle includes:

[0073] Step 2.1) associates the fault detection operation of the internal hardware of the multi-core processor and the fault detection operation of the software process of each thread to be executed in the same current cycle, so that the hardware fault detection result and the software fault detection result of the lock-step core are in the same timing.

[0074] Among them, the unified monitoring and processing measures that combine software watchdog monitoring for software fault detection and the processor's Lock-Step function for hardware fault detection are executed in the same current cycle. The hardware fault detection results and software fault detection results can be effectively analyzed to prevent the occurrence of uncontrollable faults and hardware faults. From the overall hardware and software perspectives, the monitoring accuracy and stability of the overall vehicle ECU system are improved.

[0075] On the basis of the above-mentioned embodiment, when a hardware fault is detected by the lock-step core's own function in step S104, after backup storage, a reset operation is performed to eliminate the hardware fault, and then subsequent step S106 is performed; illustratively, it can be implemented by the following steps, specifically including:

[0076] Step 3.1), under the function of the lock-step core, whether there is a processing logic fault in the internal hardware of the multi-core processor in the current cycle is detected.

[0077] Step 3.2), if there is no hardware failure, directly execute step S106.

[0078] Step 3.3), if there is a hardware failure, the first software and hardware information at the first current moment is stored and backed up according to the preset failure type, the internal hardware of the multi-core processor is reset, and the software and hardware system corresponding to the ECU is restarted.

[0079] Among them, the first software and hardware information includes hardware data and software data that meet the preset fault type requirements at the first current moment. For example, the preset fault types include A, B, C, D, E and F, where A, B, C are hardware fault types, and D, E, F are software fault types; if there is a hardware fault at this time, the hardware data in the first software and hardware information is the hardware parameter values ​​corresponding to A, B, and C respectively when the hardware fault occurs at this time, and the software fault types D, E, and F can be empty, or respectively collect the software parameter values ​​at the current moment, or respectively a preset fixed value; based on the first software and hardware information stored in this backup, the time when the fault occurs can be known, and then according to the values ​​corresponding to the hardware data and software data, it can be known that the fault type is a hardware fault.

[0080] Exemplarily, a fault judgment is performed based on the Lock-Step function of the corresponding multi-core processor in the thread. If a Lock-Step fault occurs in the multi-core processor, it indicates that a fault has occurred in the hardware processing logic inside the processor. According to the system processing requirements, the first software and hardware information of the multi-core processor is stored and backed up to facilitate fault diagnosis and fault recovery, and then the multi-core processor is reset, and the software and hardware system corresponding to the ECU to which the embodiment of the present invention is applied is restarted.

[0081] In some embodiments, when a software fault is detected, step S106 performs storage backup and resets to eliminate the software fault, and then executes step S108; illustratively, step S108 can be implemented by the following steps, specifically including:

[0082] Step 4.1), based on the comparison result of the actual execution times of each thread of the lock-step core in the preset cycle and the preset execution times, it is determined whether the software process of each thread has a fault in the current cycle.

[0083] The functional safety level of each thread corresponds to the preset number of executions within the corresponding preset period. For example, the preset number of executions will change with different functional safety levels. If the actual number of executions within the preset period exceeds the preset number of executions, the thread has a software process failure in the current period. For example, the current period can be 10 seconds and the preset period can be 20 milliseconds, which can be adjusted accordingly in actual applications.

[0084] Step 4.2), if there is no fault, directly execute the subsequent step S108; perform fault information according to the backed-up stored data.

[0085] Step 4.3), if there is a fault, the second software and hardware information at the second current moment is stored and backed up according to the preset fault type, and the software process is reset.

[0086] Among them, the second software and hardware information includes hardware data and software data that meet the preset fault type requirements at the second current moment. For example, the preset fault types include A, B, C, D, E and F, where A, B, C are hardware fault types, and D, E, F are software fault types; if there is a software fault at this time, the software data in the second software and hardware information is the software parameter values ​​corresponding to D, E, and F respectively when the software fault occurs at this time, and the hardware fault types A, B, and C can be empty, or respectively collect the hardware parameter values ​​at the current moment, or respectively a preset fixed value; based on the second software and hardware information stored in this backup, the time when the fault occurs can be known, and then according to the values ​​corresponding to the hardware data and software data, it can be known that the fault type is a software fault.

[0087] In actual applications, for monitoring software threads, the WdgM module in the NeuSAR software specifically monitors whether the threads run periodically to ensure that there is no omission or delayed execution of tasks. The blocking of threads or reasons such as exceeding expected resources and time consumption may cause the loss of monitoring points within the cycle, but if it is not a fatal system failure, a certain amount of redundant judgment and processing logic can be reserved to leave the ECU with a certain amount of fault tolerance and recovery time to ensure the robustness and stability of the overall operation of the ECU software system. Based on this, step 4.3) in the aforementioned embodiment can also consider redundant re-execution of backup and reset operations, including:

[0088] Step 4.3.1), according to the fault detection result of the software process of each thread in the current cycle, refresh the hardware trigger value corresponding to each thread.

[0089] Exemplarily, if the software process of the current thread fails in the current cycle, the hardware trigger value corresponding to the current thread is refreshed to zero; if the software process of the current thread does not fail in the current cycle, the hardware trigger value corresponding to the current thread is refreshed to the initial value.

[0090] The initial value is determined based on the fault tolerance requirement and fault recovery time requirement of each thread.

[0091] It should be noted that the watchdog monitoring redundancy judgment processing logic can be put into the system hardware interrupt, and will not be affected even if the software system fails, thereby avoiding the influence of software thread blocking on the redundant judgment, and the redundant detection of the watchdog result can be performed independently of the software timing. In practical applications, the NeuSAR-WdgM module can periodically update the hardware trigger value according to the status of all thread monitoring points; the initialization value of the trigger value is set according to the fault tolerance requirements and fault recovery time requirements of the overall software system; for example, the higher the fault tolerance requirement, the larger the hardware trigger value, the longer the redundancy time, and the better the fault tolerance redundancy capability; the shorter the fault recovery time requirement, the smaller the hardware trigger value, and once a fault occurs, the fault can be quickly reset and eliminated to meet the requirement of short fault recovery time; the fault tolerance requirement and the fault recovery time requirement can also be considered at the same time for overall analysis, and the hardware trigger value is determined as an integer greater than 0 to meet the fault tolerance requirement and the fault recovery time requirement at the same time.

[0092] Step 4.3.2), if the software process in the current thread has a fault in the current cycle, determine whether the hardware trigger value is greater than zero.

[0093] In step 4.3.3), if the hardware trigger value is greater than zero, the watchdog is fed during the hardware watchdog interrupt cycle, and the hardware trigger value is reduced by one, and then the step of determining whether the hardware trigger value is greater than zero in step 4.3.2) is executed.

[0094] Step 4.3.4), if the hardware trigger value is less than zero, the second software and hardware information at the second current moment is stored and backed up according to the preset fault type, and the software process is reset.

[0095] When a software fault occurs, as an optional embodiment, a hardware interrupt operation can be triggered by a redundant judgment method; first, whether the overall software thread monitoring is normal is determined by whether the hardware trigger value is greater than 0. When the hardware trigger value is greater than 0, it means that the software system thread monitoring is normal. Even if a software fault occurs, the fault is a non-fatal fault such as thread blocking. The current ECU software system is still within the fault tolerance range, and the operation process of the software system can continue to be executed, that is, the hardware peripheral window watchdog is fed to ensure that the hardware watchdog peripheral operates normally and does not generate a hardware reset. At the same time, the hardware trigger value is reduced by 1, indicating that the redundant judgment is normal, and the trigger value is refreshed in a new cycle. If it is determined that the hardware trigger value is less than 0, it means that the NeuSAR-WdgM software watchdog has detected a software fault, and the fault monitored by the software system has exceeded the pre-set fault tolerance capability. At this time, the system needs to store fault information and back up data, and no longer execute the hardware watchdog peripheral feeding operation. The hardware watchdog peripheral generates a hardware reset signal to reset the software system to ensure the safety of the software and hardware systems.

[0096] Specifically and exemplarily, the WdgM software watchdog logic in the NeuSAR software in each thread is judged; according to the monitoring results of all threads, the hardware trigger value in the software watchdog is refreshed regularly. If there is a fault in the software system at this time, the hardware trigger value of the watchdog monitoring redundancy algorithm is used to determine whether the fault in the entire software system is serious; if the software fault is not serious, all software threads run normally, and the window feeding operation of the hardware watchdog peripheral is executed at this time to ensure the normal operation of the hardware watchdog peripheral; if the software fault is serious, the system software thread cannot run normally at this time, then according to the system processing requirements, the preset fault information storage and data backup are executed, and the processor reset operation is executed to restart the software and hardware system for fault diagnosis and fault recovery.

[0097] The embodiment of the present invention adds a watchdog monitoring redundancy algorithm between the software watchdog monitoring and the hardware watchdog peripheral reset, and increases multi-core multi-threaded watchdog program monitoring through software logic; after a non-fatal fault occurs, sufficient cache time and fault recovery time are reserved for the system, the redundancy of the overall system is increased, and the robustness and robustness of the system are improved.

[0098] Figure 3 A schematic diagram of another multi-threaded software and hardware fault analysis method applied to a lockstep core is provided in an embodiment of the present invention.

[0099] Reference Figure 3 ,First, the hardware watchdog is initialized and the NeuSAR software watchdog is initialized; ,Then the processor Lock-step is used to determine whether there is a fault;

[0100] If there is a hardware failure, the failure information is stored and the data is backed up, and the hardware system is reset, and then the step of determining whether there is a failure based on the processor Lock-step is re-executed;

[0101] If there is no hardware fault, then if the NeuSAR-WdgM module detects a software fault, the hardware trigger value is periodically refreshed according to the detection result; and then it is determined whether the hardware trigger value is greater than 0;

[0102] If not, the fault information is stored and data is backed up, and the hardware system is reset, and then the step of determining whether there is a fault according to the processor Lock-step is re-executed;

[0103] If so, the hardware interrupt cycle dog feeding operation is executed, the hardware trigger value is reduced by 1, and then the step of determining whether the hardware trigger value is greater than 0 is executed.

[0104] The embodiment of the present invention combines the Lock-Step function of the processor multi-core architecture, and applies the advantages of faster error detection and higher error coverage of this function. It only takes 2 or 3 cycles to detect system faults in hardware, and combines the software watchdog to monitor all threads of all cores, so as to ensure the fault detection and fault coverage of the whole system from the perspective of system software and hardware as a whole. At the same time, software monitoring and hardware monitoring are unified and combined for processing. When the system hardware or software fails, the overall software and hardware system can achieve unified backup processing and unified reset operations to prevent the occurrence of uncontrollable faults and hardware faults; at the same time, the fault data between multi-cores and multi-threads is aligned, so that subsequent fault analysis and fault recovery will not cause data interference and data pollution.

[0105] In order to solve the safety redundancy defect problem of multi-threaded watchdog monitoring, a safety redundancy monitoring algorithm is added. When a non-fatal problem occurs in a software thread, watchdog monitoring can increase the safety redundancy space of the system, provide the system with additional fault recovery time, ensure the robustness and stability of the software system, and provide sufficient cache time for fault system storage and data update. The dual insurance measures of combining software safety redundancy monitoring and hardware peripheral watchdogs improve the monitoring accuracy and stability of the overall software and hardware system.

[0106] In some embodiments, Figure 4 As shown, an embodiment of the present invention further provides a multi-threaded software and hardware fault analysis device 200 applied to a lock-step core, each ECU includes a multi-core processor, each multi-core processor includes at least one lock-step core, each lock-step core is configured with multiple threads, and the device is applied to the lock-step core, including:

[0107] The detection module 201 detects the internal hardware of the multi-core processor and the software process of each thread in the current cycle; wherein the detection of the internal hardware and the software process occurs in the same cycle;

[0108] The hardware fault backup module 202 stores and backs up the first software and hardware information at the first current moment according to the preset fault type, and resets the internal hardware if the internal hardware has a processing logic fault in the current cycle; wherein the first software and hardware information is used to represent the hardware data and software data corresponding to the preset fault type when a hardware fault occurs at the first current moment;

[0109] The software fault backup module 203 stores and backs up the second software and hardware information at the second current moment according to the preset fault type, and resets the software process if the software process of at least one thread in the lock-step core has a fault in the current cycle; wherein the second software and hardware information is used to represent the hardware data and software data corresponding to the preset fault type when a software fault occurs at the second current moment;

[0110] The analysis module 204 analyzes the software and hardware failures of the lock-step core according to the first software and hardware information and the second software and hardware information.

[0111] In order to realize multi-core and multi-threaded program monitoring while taking into account the processor's Lock-Step function, the embodiment of the present invention starts from the overall software and hardware. On the basis of using the NeuSAR software (compliant with the AutoSAR standard) WdgM module, a watchdog monitoring redundancy algorithm and LockStep function fault judgment are added to comprehensively monitor the faults of the vehicle's software and hardware systems, and fully ensure the reliability of the software and hardware systems. Combined with the hardware watchdog peripheral, the processor is controlled to reset through software processing logic.

[0112] Furthermore, the detection module 201 is used to associate the fault detection operation of the internal hardware of the multi-core processor and the fault detection operation of the software process of each thread to be executed in the same current cycle, so that the hardware fault detection result and the software fault detection result of the lock-step core are in the same timing.

[0113] Furthermore, the hardware fault backup module 202 is used to detect whether there is a processing logic fault in the internal hardware of the multi-core processor in the current cycle under the function of the lock-step core; if there is a hardware fault, the first software and hardware information at the first current moment is stored and backed up according to the preset fault type, and the internal hardware of the multi-core processor is reset, and the software and hardware system corresponding to the ECU is restarted; wherein, the first software and hardware information includes hardware data and software data that meet the preset fault type requirements at the first current moment.

[0114] In some embodiments, the software fault backup module 203 is used to determine whether the software process of each thread has a fault in the current cycle based on the comparison result of the actual execution number and the preset execution number of each thread of the lock-step core in the preset cycle; wherein the functional safety level of each thread corresponds to the preset execution number in the corresponding preset cycle; if there is a fault, the second software and hardware information at the second current moment is stored and backed up according to the preset fault type, and the software process is reset; wherein the second software and hardware information includes hardware data and software data that meet the preset fault type requirements at the second current moment.

[0115] In some embodiments, the software fault backup module 203 refreshes the hardware trigger value corresponding to each thread according to the fault detection result of the software process of each thread in the current cycle; if there is a fault in the software process in the current thread in the current cycle, it is determined whether the hardware trigger value is greater than zero; if the hardware trigger value is greater than zero, the watchdog is fed in the interrupt cycle of the hardware watchdog, and the hardware trigger value is reduced by one, and then the step of determining whether the hardware trigger value is greater than zero is executed; if the hardware trigger value is less than zero, the second software and hardware information at the second current moment is stored and backed up according to the preset fault type, and the software process is reset.

[0116] In some embodiments, the software fault backup module 203 is used to refresh the hardware trigger value corresponding to the current thread to zero if the software process of the current thread has a fault in the current cycle; if the software process of the current thread does not have a fault in the current cycle, refresh the hardware trigger value corresponding to the current thread to an initial value; wherein the initial value is determined based on the fault tolerance requirements and fault recovery time requirements of each thread.

[0117] In some embodiments, before the step of respectively detecting the internal hardware of the multi-core processor and the software process of each thread in the current cycle, the device is also used to initialize the peripherals of the hardware watchdog, configure the interrupt cycle of the hardware watchdog and the fault detection configuration information corresponding to each functional safety level.

[0118] Figure 5 Schematic diagram of the hardware architecture of the electronic device 300 provided in an embodiment of the present invention. Figure 5As shown, the electronic device 300 includes: a machine-readable storage medium 301 and a processor 302, and may also include a non-volatile storage medium 303, a communication interface 304 and a bus 305; wherein the machine-readable storage medium 301, the processor 302, the non-volatile storage medium 303 and the communication interface 304 communicate with each other through the bus 305. The processor 302 can execute the multi-threaded software and hardware fault analysis method applied to the lock-step core described in the above embodiment by reading and executing the machine executable instructions for multi-threaded software and hardware fault analysis applied to the lock-step core in the machine-readable storage medium 301.

[0119] The machine-readable storage medium mentioned in this article can be any electronic, magnetic, optical or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, the machine-readable storage medium can be: RAM (Radom Access Memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), any type of storage disk (such as CD, DVD, etc.), or similar storage medium, or a combination thereof.

[0120] The non-volatile medium may be a non-volatile memory, a flash memory, a storage drive (such as a hard drive), any type of storage disk (such as a CD, DVD, etc.), or a similar non-volatile storage medium, or a combination thereof.

[0121] It can be understood that the specific operation methods of each functional module in this embodiment can refer to the detailed description of the corresponding steps in the above method embodiment, and will not be repeated here.

[0122] The computer-readable storage medium provided in the embodiment of the present invention stores a computer program. When the computer program code is executed, the multi-threaded software and hardware fault analysis method applied to the lock-step core described in any of the above embodiments can be implemented. The specific implementation can be found in the method embodiment, which will not be repeated here.

[0123] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system and device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0124] In addition, in the description of the embodiments of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0125] In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicating the orientation or positional relationship, are based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance.

[0126] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present invention, which are used to illustrate the technical solutions of the present invention rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the aforementioned embodiments, those of ordinary skill in the art should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the aforementioned embodiments within the technical scope disclosed by the present invention, or can easily conceive of changes, or make equivalent replacements for some of the technical features therein. Such modifications, changes or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the protection scope of the present invention.

Claims

1. A multi-threaded software and hardware fault analysis method applied to a lock-step core, characterized in that: Each ECU includes a multi-core processor, each multi-core processor includes at least one lock-step core, each lock-step core is configured with multiple threads, and the method is applied to the lock-step core, including: In the current cycle, the internal hardware of the multi-core processor and the software process of each thread are detected respectively; wherein the detection of the internal hardware and the software process occurs in the same cycle; If the internal hardware has a processing logic fault in the current cycle, the first software and hardware information at the first current moment is stored and backed up according to the preset fault type, and the internal hardware is reset; wherein the first software and hardware information is used to represent the hardware data and software data corresponding to the preset fault type when a hardware fault occurs at the first current moment; If a software process of at least one thread in the lock-step core has a fault in the current cycle, the second software and hardware information at the second current moment is stored and backed up according to the preset fault type, and the software process is reset; wherein the second software and hardware information is used to represent the hardware data and software data corresponding to the preset fault type when a software fault occurs at the second current moment; The software and hardware failures of the lock-step core are analyzed according to the first software and hardware information and the second software and hardware information.

2. The method according to claim 1, characterized in that The step of detecting the internal hardware of the multi-core processor and the software process of each thread in the current cycle respectively includes: The fault detection operation on the internal hardware of the multi-core processor and the fault detection operation on the software process of each thread are associated and executed in the same current cycle, so that the hardware fault detection result and the software fault detection result of the lock-step core are in the same time sequence.

3. The method according to claim 1, characterized in that: If the internal hardware has a processing logic fault in the current cycle, the steps of storing and backing up the first software and hardware information at the first current moment according to the preset fault type and resetting the internal hardware include: Under the function of the lock-step core, detecting whether there is a processing logic fault in the internal hardware of the multi-core processor in the current cycle; If a hardware failure occurs, the first hardware and software information at the first current moment is stored and backed up according to the preset fault type, the internal hardware of the multi-core processor is reset, and the hardware and software system corresponding to the ECU is restarted; wherein the first hardware and software information includes hardware data and software data that meet the requirements of the preset fault type at the first current moment.

4. The method according to claim 1, characterized in that If a software process of at least one thread in the lock-step core fails in a current cycle, the steps of storing and backing up second software and hardware information at a second current moment according to a preset fault type and resetting the software process include: Based on the comparison result of the actual execution times and the preset execution times of each thread of the lock-step core in the preset cycle, judging whether the software process of each thread has a fault in the current cycle; wherein the functional safety level of each thread corresponds to the preset execution times in the corresponding preset cycle; If a fault exists, the second software and hardware information at the second current moment is stored and backed up according to the preset fault type, and the software process is reset; wherein the second software and hardware information includes hardware data and software data that meet the preset fault type requirements at the second current moment.

5. The method according to claim 1 or 4, characterized in that: If there is a fault, the second software and hardware information at the second current moment is stored and backed up according to the preset fault type, and the step of resetting the software process also includes: Refresh the hardware trigger value corresponding to each thread according to the fault detection result of the software process of each thread in the current cycle; If the software process in the current thread has a fault in the current cycle, determining whether the hardware trigger value is greater than zero; If the hardware trigger value is greater than zero, the watchdog is fed during the interrupt cycle of the hardware watchdog, and the hardware trigger value is reduced by one, and then the step of determining whether the hardware trigger value is greater than zero is performed; If the hardware trigger value is less than zero, the second software and hardware information at the second current moment is stored and backed up according to the preset fault type, and the software process is reset.

6. The method according to claim 5, characterized in that The step of refreshing the hardware trigger value corresponding to each thread according to the fault detection result of the software process of each thread in the current cycle includes: If the software process of the current thread fails in the current cycle, the hardware trigger value corresponding to the current thread is refreshed to zero; If the software process of the current thread does not have any faults in the current cycle, the hardware trigger value corresponding to the current thread is refreshed to an initial value; wherein the initial value is determined based on the fault tolerance requirement and fault recovery time requirement of each thread.

7. The method according to claim 1, characterized in that Before the step of detecting the internal hardware of the multi-core processor and the software process of each thread in the current cycle, the method further includes: Initialize the peripherals of the hardware watchdog, and configure the interrupt cycle of the hardware watchdog and the fault detection configuration information corresponding to each functional safety level.

8. A multi-threaded software and hardware fault analysis device applied to a lock-step core, characterized in that: Each ECU includes a multi-core processor, each multi-core processor includes at least one lock-step core, each lock-step core is configured with multiple threads, and the device is applied to the lock-step core, including: A detection module, which detects the internal hardware of the multi-core processor and the software process of each thread in a current cycle; wherein the detection of the internal hardware and the software process occurs in the same cycle; A hardware fault backup module, if the internal hardware has a processing logic fault in the current cycle, stores and backs up the first software and hardware information at the first current moment according to a preset fault type, and resets the internal hardware; wherein the first software and hardware information is used to represent the hardware data and software data corresponding to the preset fault type when a hardware fault occurs at the first current moment; A software fault backup module, if a software process of at least one thread in the lock-step core has a fault in a current cycle, stores and backs up second software and hardware information at a second current moment according to a preset fault type, and resets the software process; wherein the second software and hardware information is used to represent hardware data and software data corresponding to the preset fault type when a software fault occurs at the second current moment; An analysis module analyzes the software and hardware failures of the lock-step core according to the first software and hardware information and the second software and hardware information.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A machine-readable storage medium, characterized in that: The machine-readable storage medium stores machine-executable instructions. When the machine-executable instructions are called and executed by a processor, the machine-executable instructions prompt the processor to implement the steps of the method described in any one of claims 1 to 7.

Images